When operating in NX mode, GUCODE_SEL can cover the entire userland
address space permanently, and the line-in-the-sand manipulation
T_PROTFLT|T_USER fixup handling can be skipped. This change was written
to side-step the segment-descriptor mismanagement issues, commited recently
for the "go on i386"
tested by sthen
ok kettenis guenther

Make sure we fetch the CS limit of the CPU the trap happened on. It is
possible to switch CPUs when handling a trap since we need to lock the vm_map
of the process. In that case the CS limit would be wrong an we incorrectly
decide that there has been an execute privilige violation.
Also make sure we only modify the variables that keep track of the CS
limit and segment descriptor while holding the kernel lock.

Fixes builds of go ports on i386.

tested by sthen@
ok deraadt@

Delete the VM86 kernel option and i386_vm86(3) API: it's required
a custom kernel for over 20 years.

testing mlarkin@
ok deraadt@ phessler@ jca@ matthieu@

Finish the last missing piece for the i386 meltdown fix:
- handle protection fault on iret properly
- handle NMI
- actually enable U-K in pmap_switch()
from hshoexer@; input guenther@; OK mlarkin@ deraadt@

Recommit preparation for i386 Meltdown fix after OpenBSD 6.3 release.

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

iBackout the preparations for fixing Meltdown on i386. The task was
only halfway done and the current state does not help anybody. For
OpenBSD 6.3 release go back to the original code before 2018/03/13.
This gives us a stable release and the changes will come back later.
discussed with guenther@ deraadt@ hshoexer@

Preparation for i386 Meltdown fix:

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

Burn more LDT deadwood: stop allocating one for each idle thread,
load the ldt register with the null selector (disabling use of it),
stop reloading it on every context switch, and blow away the table
itself, as well as the pcb and pmap bits that were used to track
it (making sure to keep pcb_savefpu correctly aligned).

testing naddy@
ok kettenis@ mpi@ mlarkin@

Normalize sentinel. Use _MACHINE_*_H_ and _<ARCH>_*_H_ properly and consitently.

Discussed and okay drahn@. Okay deraadt@.

Provide distinct segments for the %fs and %gs selectors to use by
default, with per-rthread base offsets and with sysarch() functions,
I386_{GET,SET}_{FS,GS}BASE, for fetching and setting those base
offsets. This is necessary for both rthread and Linux compat support.

suggestions from kettenis@, prodding from pirofti@ and deraadt@

the bsdi ldt entry is no longer interesting. from valdimir kirillov

another day, another compat gets removed. today is ibcs2's turn

Garbage collect the LDT segments, and simply use the GDT segments.
The beginning of i386 segment review/cleanup.

Tested by various people.

Avoid #pragma pack(1) and unify everything towards using __packed.
This requires that structures defined within __packed structures must
independently request that they themselves become __packed, too.
worked on with toby
CVS: ----------------------------------------------------------------------

Move to using gdt only (no more ldt in general case) but with a variable
limit selector, so that the w^x line can float much more dynamically.
Much work done by tom. Tested by various people. Addresses concerns of
(Julien Tinnes) <julien ATHOST cr0.org>

branches: 1.13.4; 1.13.6;
debranch SMP, have fun

convert __attribute__((__packed__)) to __packed so that parsers unaware
of gcc extensions have more of a chance.
ok mcbride@, no objections from millert@, deraadt@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

support for changing stack execution protection through mprotect()
by emulating the page execution protection bit and accounting
for pages mapped executable on the stack and swapping the
global user code descriptors for the process accordingly.
this is tested w/ the regress test and art@ looked over it.

there is still a mistery how executable mappings on fault
works on i386 since no prot_exec faults ever happen.

First round of __P removal in sys

branches: 1.8.6;
use __x__ formats for __attribute__ arguments; guenther@gac.edu

$OpenBSD$

branches: 1.6.10;
Intel P5 f00f workaround; weingart & who knows who else

Do interrupt time accounting by running interrupt handlers with a seperate
code segment selector (otherwise identical to the standard kernel code
selector); idea by Dave Richards <richards@zso.dec.com>

Pull in John Kohl's [jtk@netbsd.org] most recent (15Apr96) APM and PCMCIA work
(original PCMCIA framework by Stefan Grefen [grefen@convex.com]).

Merging w/ NetBSD 021796.
speaker upgraded to the current.
some changes to the VM stuff (ie kern_thread.c added and so).

from netbsd; use __attribute__((packed)) if it is available

branches: 1.1.1;
Initial revision

Delete the VM86 kernel option and i386_vm86(3) API: it's required
a custom kernel for over 20 years.

testing mlarkin@
ok deraadt@ phessler@ jca@ matthieu@

Finish the last missing piece for the i386 meltdown fix:
- handle protection fault on iret properly
- handle NMI
- actually enable U-K in pmap_switch()
from hshoexer@; input guenther@; OK mlarkin@ deraadt@

Recommit preparation for i386 Meltdown fix after OpenBSD 6.3 release.

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

iBackout the preparations for fixing Meltdown on i386. The task was
only halfway done and the current state does not help anybody. For
OpenBSD 6.3 release go back to the original code before 2018/03/13.
This gives us a stable release and the changes will come back later.
discussed with guenther@ deraadt@ hshoexer@

Preparation for i386 Meltdown fix:

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

Burn more LDT deadwood: stop allocating one for each idle thread,
load the ldt register with the null selector (disabling use of it),
stop reloading it on every context switch, and blow away the table
itself, as well as the pcb and pmap bits that were used to track
it (making sure to keep pcb_savefpu correctly aligned).

testing naddy@
ok kettenis@ mpi@ mlarkin@

Normalize sentinel. Use _MACHINE_*_H_ and _<ARCH>_*_H_ properly and consitently.

Discussed and okay drahn@. Okay deraadt@.

Provide distinct segments for the %fs and %gs selectors to use by
default, with per-rthread base offsets and with sysarch() functions,
I386_{GET,SET}_{FS,GS}BASE, for fetching and setting those base
offsets. This is necessary for both rthread and Linux compat support.

suggestions from kettenis@, prodding from pirofti@ and deraadt@

the bsdi ldt entry is no longer interesting. from valdimir kirillov

another day, another compat gets removed. today is ibcs2's turn

Garbage collect the LDT segments, and simply use the GDT segments.
The beginning of i386 segment review/cleanup.

Tested by various people.

Avoid #pragma pack(1) and unify everything towards using __packed.
This requires that structures defined within __packed structures must
independently request that they themselves become __packed, too.
worked on with toby
CVS: ----------------------------------------------------------------------

Move to using gdt only (no more ldt in general case) but with a variable
limit selector, so that the w^x line can float much more dynamically.
Much work done by tom. Tested by various people. Addresses concerns of
(Julien Tinnes) <julien ATHOST cr0.org>

branches: 1.13.4; 1.13.6;
debranch SMP, have fun

convert __attribute__((__packed__)) to __packed so that parsers unaware
of gcc extensions have more of a chance.
ok mcbride@, no objections from millert@, deraadt@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

support for changing stack execution protection through mprotect()
by emulating the page execution protection bit and accounting
for pages mapped executable on the stack and swapping the
global user code descriptors for the process accordingly.
this is tested w/ the regress test and art@ looked over it.

there is still a mistery how executable mappings on fault
works on i386 since no prot_exec faults ever happen.

First round of __P removal in sys

branches: 1.8.6;
use __x__ formats for __attribute__ arguments; guenther@gac.edu

$OpenBSD$

branches: 1.6.10;
Intel P5 f00f workaround; weingart & who knows who else

Do interrupt time accounting by running interrupt handlers with a seperate
code segment selector (otherwise identical to the standard kernel code
selector); idea by Dave Richards <richards@zso.dec.com>

Pull in John Kohl's [jtk@netbsd.org] most recent (15Apr96) APM and PCMCIA work
(original PCMCIA framework by Stefan Grefen [grefen@convex.com]).

Merging w/ NetBSD 021796.
speaker upgraded to the current.
some changes to the VM stuff (ie kern_thread.c added and so).

from netbsd; use __attribute__((packed)) if it is available

branches: 1.1.1;
Initial revision

Finish the last missing piece for the i386 meltdown fix:
- handle protection fault on iret properly
- handle NMI
- actually enable U-K in pmap_switch()
from hshoexer@; input guenther@; OK mlarkin@ deraadt@

Recommit preparation for i386 Meltdown fix after OpenBSD 6.3 release.

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

iBackout the preparations for fixing Meltdown on i386. The task was
only halfway done and the current state does not help anybody. For
OpenBSD 6.3 release go back to the original code before 2018/03/13.
This gives us a stable release and the changes will come back later.
discussed with guenther@ deraadt@ hshoexer@

Preparation for i386 Meltdown fix:

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

Burn more LDT deadwood: stop allocating one for each idle thread,
load the ldt register with the null selector (disabling use of it),
stop reloading it on every context switch, and blow away the table
itself, as well as the pcb and pmap bits that were used to track
it (making sure to keep pcb_savefpu correctly aligned).

testing naddy@
ok kettenis@ mpi@ mlarkin@

Normalize sentinel. Use _MACHINE_*_H_ and _<ARCH>_*_H_ properly and consitently.

Discussed and okay drahn@. Okay deraadt@.

Provide distinct segments for the %fs and %gs selectors to use by
default, with per-rthread base offsets and with sysarch() functions,
I386_{GET,SET}_{FS,GS}BASE, for fetching and setting those base
offsets. This is necessary for both rthread and Linux compat support.

suggestions from kettenis@, prodding from pirofti@ and deraadt@

the bsdi ldt entry is no longer interesting. from valdimir kirillov

another day, another compat gets removed. today is ibcs2's turn

Garbage collect the LDT segments, and simply use the GDT segments.
The beginning of i386 segment review/cleanup.

Tested by various people.

Avoid #pragma pack(1) and unify everything towards using __packed.
This requires that structures defined within __packed structures must
independently request that they themselves become __packed, too.
worked on with toby
CVS: ----------------------------------------------------------------------

Move to using gdt only (no more ldt in general case) but with a variable
limit selector, so that the w^x line can float much more dynamically.
Much work done by tom. Tested by various people. Addresses concerns of
(Julien Tinnes) <julien ATHOST cr0.org>

branches: 1.13.4; 1.13.6;
debranch SMP, have fun

convert __attribute__((__packed__)) to __packed so that parsers unaware
of gcc extensions have more of a chance.
ok mcbride@, no objections from millert@, deraadt@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

support for changing stack execution protection through mprotect()
by emulating the page execution protection bit and accounting
for pages mapped executable on the stack and swapping the
global user code descriptors for the process accordingly.
this is tested w/ the regress test and art@ looked over it.

there is still a mistery how executable mappings on fault
works on i386 since no prot_exec faults ever happen.

First round of __P removal in sys

branches: 1.8.6;
use __x__ formats for __attribute__ arguments; guenther@gac.edu

$OpenBSD$

branches: 1.6.10;
Intel P5 f00f workaround; weingart & who knows who else

Do interrupt time accounting by running interrupt handlers with a seperate
code segment selector (otherwise identical to the standard kernel code
selector); idea by Dave Richards <richards@zso.dec.com>

Pull in John Kohl's [jtk@netbsd.org] most recent (15Apr96) APM and PCMCIA work
(original PCMCIA framework by Stefan Grefen [grefen@convex.com]).

Merging w/ NetBSD 021796.
speaker upgraded to the current.
some changes to the VM stuff (ie kern_thread.c added and so).

from netbsd; use __attribute__((packed)) if it is available

branches: 1.1.1;
Initial revision

Recommit preparation for i386 Meltdown fix after OpenBSD 6.3 release.

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

iBackout the preparations for fixing Meltdown on i386. The task was
only halfway done and the current state does not help anybody. For
OpenBSD 6.3 release go back to the original code before 2018/03/13.
This gives us a stable release and the changes will come back later.
discussed with guenther@ deraadt@ hshoexer@

Preparation for i386 Meltdown fix:

- provide a cpu_softc for cpu_attach() etc.
- replace per PCB TSS with per CPU TSS

The first change prepares for cpu_info being embedded in a
cpu_full_info. Therefore during autoconf/cpu_attach we hand down
a softc.

The second change removes the per PCB TSS. We now have one TSS per
CPU, thus in cpu_switchto() we only have to patch the ring 0 stack
pointer instead of loading a new TSS. This also allows for cleaning
up the GDT, so we only have a single slot for the TSS.

from hshoexer@; OK deraadt@

Burn more LDT deadwood: stop allocating one for each idle thread,
load the ldt register with the null selector (disabling use of it),
stop reloading it on every context switch, and blow away the table
itself, as well as the pcb and pmap bits that were used to track
it (making sure to keep pcb_savefpu correctly aligned).

testing naddy@
ok kettenis@ mpi@ mlarkin@

Normalize sentinel. Use _MACHINE_*_H_ and _<ARCH>_*_H_ properly and consitently.

Discussed and okay drahn@. Okay deraadt@.

Provide distinct segments for the %fs and %gs selectors to use by
default, with per-rthread base offsets and with sysarch() functions,
I386_{GET,SET}_{FS,GS}BASE, for fetching and setting those base
offsets. This is necessary for both rthread and Linux compat support.

suggestions from kettenis@, prodding from pirofti@ and deraadt@

the bsdi ldt entry is no longer interesting. from valdimir kirillov

another day, another compat gets removed. today is ibcs2's turn

Garbage collect the LDT segments, and simply use the GDT segments.
The beginning of i386 segment review/cleanup.

Tested by various people.

Avoid #pragma pack(1) and unify everything towards using __packed.
This requires that structures defined within __packed structures must
independently request that they themselves become __packed, too.
worked on with toby
CVS: ----------------------------------------------------------------------

Move to using gdt only (no more ldt in general case) but with a variable
limit selector, so that the w^x line can float much more dynamically.
Much work done by tom. Tested by various people. Addresses concerns of
(Julien Tinnes) <julien ATHOST cr0.org>

branches: 1.13.4; 1.13.6;
debranch SMP, have fun

convert __attribute__((__packed__)) to __packed so that parsers unaware
of gcc extensions have more of a chance.
ok mcbride@, no objections from millert@, deraadt@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

support for changing stack execution protection through mprotect()
by emulating the page execution protection bit and accounting
for pages mapped executable on the stack and swapping the
global user code descriptors for the process accordingly.
this is tested w/ the regress test and art@ looked over it.

there is still a mistery how executable mappings on fault
works on i386 since no prot_exec faults ever happen.

First round of __P removal in sys

branches: 1.8.6;
use __x__ formats for __attribute__ arguments; guenther@gac.edu

$OpenBSD$

branches: 1.6.10;
Intel P5 f00f workaround; weingart & who knows who else

Do interrupt time accounting by running interrupt handlers with a seperate
code segment selector (otherwise identical to the standard kernel code
selector); idea by Dave Richards <richards@zso.dec.com>

Pull in John Kohl's [jtk@netbsd.org] most recent (15Apr96) APM and PCMCIA work
(original PCMCIA framework by Stefan Grefen [grefen@convex.com]).

Merging w/ NetBSD 021796.
speaker upgraded to the current.
some changes to the VM stuff (ie kern_thread.c added and so).

from netbsd; use __attribute__((packed)) if it is available

branches: 1.1.1;
Initial revision

Burn more LDT deadwood: stop allocating one for each idle thread,
load the ldt register with the null selector (disabling use of it),
stop reloading it on every context switch, and blow away the table
itself, as well as the pcb and pmap bits that were used to track
it (making sure to keep pcb_savefpu correctly aligned).

testing naddy@
ok kettenis@ mpi@ mlarkin@

Normalize sentinel. Use _MACHINE_*_H_ and _<ARCH>_*_H_ properly and consitently.

Discussed and okay drahn@. Okay deraadt@.

Provide distinct segments for the %fs and %gs selectors to use by
default, with per-rthread base offsets and with sysarch() functions,
I386_{GET,SET}_{FS,GS}BASE, for fetching and setting those base
offsets. This is necessary for both rthread and Linux compat support.

suggestions from kettenis@, prodding from pirofti@ and deraadt@

the bsdi ldt entry is no longer interesting. from valdimir kirillov

another day, another compat gets removed. today is ibcs2's turn

Garbage collect the LDT segments, and simply use the GDT segments.
The beginning of i386 segment review/cleanup.

Tested by various people.

Avoid #pragma pack(1) and unify everything towards using __packed.
This requires that structures defined within __packed structures must
independently request that they themselves become __packed, too.
worked on with toby
CVS: ----------------------------------------------------------------------

Move to using gdt only (no more ldt in general case) but with a variable
limit selector, so that the w^x line can float much more dynamically.
Much work done by tom. Tested by various people. Addresses concerns of
(Julien Tinnes) <julien ATHOST cr0.org>

branches: 1.13.4; 1.13.6;
debranch SMP, have fun

convert __attribute__((__packed__)) to __packed so that parsers unaware
of gcc extensions have more of a chance.
ok mcbride@, no objections from millert@, deraadt@

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

support for changing stack execution protection through mprotect()
by emulating the page execution protection bit and accounting
for pages mapped executable on the stack and swapping the
global user code descriptors for the process accordingly.
this is tested w/ the regress test and art@ looked over it.

there is still a mistery how executable mappings on fault
works on i386 since no prot_exec faults ever happen.

First round of __P removal in sys

branches: 1.8.6;
use __x__ formats for __attribute__ arguments; guenther@gac.edu

$OpenBSD$

branches: 1.6.10;
Intel P5 f00f workaround; weingart & who knows who else

Do interrupt time accounting by running interrupt handlers with a seperate
code segment selector (otherwise identical to the standard kernel code
selector); idea by Dave Richards <richards@zso.dec.com>

Pull in John Kohl's [jtk@netbsd.org] most recent (15Apr96) APM and PCMCIA work
(original PCMCIA framework by Stefan Grefen [grefen@convex.com]).

Merging w/ NetBSD 021796.
speaker upgraded to the current.
some changes to the VM stuff (ie kern_thread.c added and so).

from netbsd; use __attribute__((packed)) if it is available

branches: 1.1.1;
Initial revision